1. Field of the Invention
The present invention relates to a computer system, and deals more particularly with a method, system, and computer program product for enabling use of smart cards by consumer devices for Internet commerce. This is achieved by integrating an existing “Integrated Circuit Card Specification for Application Payment Systems” standard (commonly known as the “EMV” standard) with an augmented Four-Party Credit/Debit Payment Protocol disclosed in U.S. Pat. No. 6,327,578.
2. Description of the Related Art
Using the Internet and World Wide Web (where the World Wide Web, hereinafter “Web”, is a subset of the Internet) for “on-line shopping” with a credit or debit card, a consumer today is able to purchase items from merchants around the corner, as well as from merchants around the globe and anywhere in between, all from the comfort of the consumer's own home. (Hereinafter, the terms “Internet” and “Web” are used interchangeably unless otherwise noted.) A consumer navigates to a merchant's Web site, and typically browses one or more Web pages to select goods or services to purchase. The consumer uses a credit or debit card for an on-line shopping transaction by supplying the card number to the merchant-for the amount of the purchase. There are various methods for supplying the consumer's card information, including the use of “electric wallet” software which is becoming common on many systems. An electronic wallet, which is often referred to simply as a “wallet”, is software which securely stores the consumer's card information (and may also store other information such as the consumer's name and billing address). When a purchase is made over the Internet, the wallet software provides the consumer's personal information to the merchant as part of the purchasing transaction, thereby relieving the consumer of the burden of remembering and retyping the stored information for each transaction. The wallet software typically executes on the consumer's computing device, and is invoked in response to a message from the merchant after the consumer indicates he or she wishes to make a purchase. The result of using the wallet software is essentially the same as using a telephone to order products from a merchant and verbally exchanging information such as card number, name, address, etc. (Server-based wallet software implementations are also known in the art, where the wallet software operates either entirely or partly on a network-based server. These wallets are accessed over the network by the consumer's browser or by thin-client software that, at a minimum, assures authentication of the consumer.)
U.S. Pat. No. 6,327,578 (Ser. No. 09/221,869, filed Dec 29, 1998), which is titled “Four-Party Credit/Debit Payment Protocol” and which is incorporated herein by reference, teaches a technique for efficiently authorizing credit and debit card transactions for a consumer when shopping on the Internet. (This invention is referred to hereinafter as “the related invention”, and the protocol disclosed therein is hereinafter referred to as “the 4-party protocol”.) The authorization process is performed between a consumer (using his or her credit or debit card and a consumer device such as a personal computer, or “PC”) and the bank that issued the consumer's card (hereinafter referred to as the “issuing bank” or “issuer”). This is in contrast to prior art techniques, as will now be described.
Without the use of this 4-party protocol, authorization is more complex and requires much more system overhead (as described in the related invention). The techniques existing in the prior art, before the related invention, began by the consumer indicating to the merchant that he or she wished to purchase an item, after which the merchant requested the credit or debit card information from the consumer either directly (e.g. by sending a Web page into which the consumer would fill in the blanks) or by sending an initialization message to start the consumer's wallet software. When the merchant received the card information, either from the returned Web page or from the wallet software, the merchant would then request an authorization for the transaction from the issuing bank by routing the authorization request through the bank used by the merchant for card transactions (hereinafter referred to as the “acquiring bank”), through a private card network (operated by MasterCard®, Visa®, or a similar company or card association), and finally to the issuing bank. Once the transaction was authorized by the issuing bank, the authorization was routed back over the card network to the acquiring bank and then to the merchant. The merchant then indicated to the consumer that the purchase was approved. At some later point in time, the merchant sent the necessary information to the acquiring bank to collect the funds from the issuing bank. (“MasterCard” is a registered trademark of MasterCard International Incorporated, and “Visa” is a registered trademark of Visa International Service Association.)
One key advantage of using the 4-party protocol is the ability to send a “pre-authorized” payment message from the consumer's wallet to the merchant. By using the 4-party protocol, the consumer's computing device (which will be referred to as a PC hereinafter, for ease of reference) interacts directly with the issuing bank to perform the authorization, instead of the merchant requesting the authorization as in the prior art. When the issuing bank has authorized the transaction, it sends an “authorization token” (which is the pre-authorized payment message) to the consumer's PC, which is then forwarded to the merchant as part of the payment response from the consumer's wallet. The merchant need not perform a separate real-time authorization of the card information since the transaction has already been approved by the issuing bank. (The merchant at some later time forwards the authorization token to the acquiring bank to use for requesting the funds from the issuing bank.)
A new type of card has emerged in recent years that is designed to be more secure than existing credit and debit cards. This card is referred to as a “smart card”. This smart card includes a logic chip that contains stored information pertaining to the owner, such as the owner's name, address, and account number; the card issuer (such as Mastercard, Visa, etc.); a Personal Identification Number (PIN); and any limitations on the card's use (such as a dollar maximum used for an individual purchase). A standard titled “Integrated Circuit Card Application Specification for Payment Systems” specifies how credit and debit card systems may use smart cards for point-of sale (POS) retail purchases and automated teller machine (ATM) transactions. This standard was promulgated by three of the leaders in the charge card industry: Europay International, Master, and Visa. Because of the involvement of these parties in drafting the standard, the card standard is commonly referred to as the “EMV” standard. (The most recent version of the EMV standard is version 3.1.1, dated May 31, 1998, which may be found on the Internet.
The smart card is designed for use in a device attached to a POS terminal (or ATM) which is physically located at a merchant's business. Instead of “swiping” the card (as with current credit and debit cards that contain a magnetic stripe), the merchant or consumer will plug the smart card into a smart card reader. Power is then supplied to the card by the POS terminal (or ATM), and information is exchanged between the terminal and the smart card to enable a consumer to perform a transaction. (Hereinafter, smart cards are discussed with reference to use with a POS terminal. These discussions apply equivalently to use of a smart card with an ATM unless stated otherwise.)
According to the EMV standard, there are two types of authorization interaction that may occur between the smart card and the merchant. The first type of authorization is “off-line authorization”, where logic on the card directly approves the transaction using information available from the smart card and POS terminal. This may occur, for example, when the transaction amount and other parameters fall within risk management guidelines established by the card issuer, merchant, and acquirer. The second type of authorization is “on-line authorization”, where the transaction must be authorized by the issuing bank using a message sent from the card, through the POS terminal, the acquiring bank, the appropriate card network (i.e. MasterCard, Visa, etc.) and finally to the issuing bank. The transaction is either approved or declined in a response message sent from the issuing bank via the card network to the acquiring bank, to the merchant's POS terminal, and ultimately to the consumer's smart card. Following a successful transaction (i.e. when the consumer is authorized for the transaction), a message is eventually transmitted from the merchant to the acquiring bank to actually collect the funds associated with the transaction from the issuing bank.
The EMV standard is defined for use with POS terminals which are physically located at a merchant's business, as previously stated. The standard presumes the POS terminal can be trusted to perform a number of critical security functions such as the authorization of transactions. Because a consumer device is under control of the consumer, responsibility for these security functions must be moved elsewhere, and thus the existing EMV standard does not directly adapt to use of smart cards in conjunction with Internet purchases (where the physical merchant POS terminal does not exist). Furthermore, the existing EMV standard fails to take advantage of the global connectivity of the Internet when performing transaction authorization.
Accordingly, what is needed is a technique which allows consumers to purchase items from a consumer computing device over the Internet using smart card technology, but without requiring modification of the existing EMV standard or of existing smart cards.